@supatype/cli 0.1.5 → 0.1.7

package/src/field-masking-tier.ts

@@ -0,0 +1,107 @@
+/**
+ * Which mechanism will enforce this project's per-column rules — decided offline.
+ *
+ * The engine makes the same decision at push time by asking the database whether `supatype_mask` is
+ * installed. The CLI has to answer earlier: it writes `PGRST_DB_SCHEMA` when it generates compose,
+ * before any database necessarily exists. It can, because the extension needs
+ * `shared_preload_libraries` and a compiled library on the host, so exactly one path ships it —
+ * `supatype/postgres`. Everything else gets the view tier:
+ *
+ * | Config                                       | Ships the extension | Tier      |
+ * | -------------------------------------------- | ------------------- | --------- |
+ * | `database.provider: "docker"`                | yes                 | extension |
+ * | `provider: native`                           | no                  | views     |
+ * | `database.external`                          | no                  | views     |
+ * | `provider: docker` + `database.image` override | no                | views     |
+ *
+ * Deliberately **not** "is the database external": a native `supatype dev` has no extension either,
+ * and treating it as tier 1 would point PostgREST at a schema whose tables the API roles no longer
+ * hold privileges on — every request denied.
+ *
+ * The one case this cannot call is a self-managed Postgres where the operator compiled and installed
+ * the extension themselves and points at it with `database.external`. They set `schema.api_schemas`
+ * explicitly; `supatype db check` reports the mismatch either way.
+ */
+
+import { existsSync } from "node:fs"
+// Statically imported: these packages are ESM, where `require` does not exist. The first attempt used
+// it for a lazy import and every command that generates compose would have thrown at runtime — caught
+// by the tests that run the built binary rather than the source.
+import { loadSchemaAst } from "./config.js"
+export { nativeMaskLibraryPresent } from "./postgres-ctl.js"
+import type { SupatypeProjectConfig } from "./project-config.js"
+import {
+  resolveRuntimeProvider,
+  schemaPathFromProject,
+  usesExternalDatabase,
+} from "./project-config.js"
+
+export type FieldMaskingTier = "none" | "extension" | "views"
+
+
+/** Postgres image this project would run, when it runs one at all. */
+function postgresImage(config: SupatypeProjectConfig): string | undefined {
+  if (usesExternalDatabase(config)) return undefined
+  if (config.database.provider !== "docker" && resolveRuntimeProvider(config) !== "docker") {
+    return undefined
+  }
+  return config.database.image?.trim() || "supatype/postgres:latest"
+}
+
+/** True when the Postgres this project runs is one that carries `supatype_mask`. */
+export function imageShipsMaskExtension(config: SupatypeProjectConfig): boolean {
+  const image = postgresImage(config)
+  return image !== undefined && /^supatype\/postgres(:|$)/.test(image)
+}
+
+/**
+ * Whether any model masks a column.
+ *
+ * Read from the extracted AST rather than the config, because that is where field rules live. Shaped
+ * loosely on purpose: the CLI's AST type carries `platform.access` as an opaque record, and this only
+ * needs to know whether a `fields` map is present and non-empty.
+ */
+export function schemaHasFieldRules(ast: unknown): boolean {
+  const models = (ast as { models?: unknown[] } | null)?.models
+  if (!Array.isArray(models)) return false
+  return models.some((model) => {
+    const access = (
+      model as { annotations?: { platform?: { access?: Record<string, unknown> } } } | null
+    )?.annotations?.platform?.access
+    const fields = access?.["fields"]
+    return typeof fields === "object" && fields !== null && Object.keys(fields).length > 0
+  })
+}
+
+/** The tier this project's next push will use. */
+export function fieldMaskingTier(
+  config: SupatypeProjectConfig,
+  ast: unknown,
+  /** Set on the native path once the Postgres install is known — see [`nativeMaskLibraryPresent`]. */
+  maskLibraryPresent?: boolean,
+): FieldMaskingTier {
+  if (!schemaHasFieldRules(ast)) return "none"
+  if (maskLibraryPresent === true) return "extension"
+  return imageShipsMaskExtension(config) ? "extension" : "views"
+}
+
+/**
+ * The tier for a project on disk, loading its schema to see whether any column is masked.
+ *
+ * A schema that fails to load falls back to `"none"` — the default exposed-schema list. Deciding the
+ * tier is the wrong moment to report a syntax error, and `push`/`dev` do it properly moments later
+ * with the file and line.
+ */
+export function fieldMaskingTierFromProject(
+  cwd: string,
+  config: SupatypeProjectConfig,
+  maskLibraryPresent?: boolean,
+): FieldMaskingTier {
+  try {
+    const schemaPath = schemaPathFromProject(config, cwd)
+    if (!existsSync(schemaPath)) return "none"
+    return fieldMaskingTier(config, loadSchemaAst(schemaPath, cwd), maskLibraryPresent)
+  } catch {
+    return "none"
+  }
+}

package/src/functions-deno-types.ts

@@ -0,0 +1,188 @@
+/**
+ * Scaffold Deno IDE types for edge functions so tsserver / Cursor stop
+ * reporting "Cannot find name 'Deno'" under the project root tsconfig.
+ *
+ * We ship a curated ambient declaration (not `@types/deno` at the app root):
+ * installing `@types/deno` as a project dependency auto-includes it in the
+ * whole app when root `tsconfig` omits `"types"`, which pollutes React/Next.
+ */
+
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  writeFileSync,
+} from "node:fs"
+import { join, relative } from "node:path"
+import ts from "typescript"
+
+const MARKER = "Supatype edge functions (IDE / tsserver)"
+
+/** Ambient Deno types written into `functions/deno.d.ts`. */
+export function functionsDenoAmbientSource(): string {
+  return `/**
+ * ${MARKER}.
+ * Runtime is Deno; this file covers APIs edge functions commonly use.
+ * Do not add \`@types/deno\` to the app package.json — it leaks into the
+ * whole project when root tsconfig has no \`"types"\` field.
+ *
+ * Optional: for the full Deno API, install the Deno VS Code/Cursor extension
+ * and open \`functions/\` as a Deno-enabled workspace folder.
+ */
+/* eslint-disable @typescript-eslint/no-unused-vars */
+
+interface DenoEnv {
+  /** Returns the value of the environment variable, or \`undefined\` if unset. */
+  get(key: string): string | undefined
+  set(key: string, value: string): void
+  delete(key: string): void
+  has(key: string): boolean
+  toObject(): { [key: string]: string }
+}
+
+declare namespace Deno {
+  const env: DenoEnv
+
+  namespace errors {
+    class NotFound extends Error {}
+    class PermissionDenied extends Error {}
+  }
+
+  interface DirEntry {
+    name: string
+    isFile: boolean
+    isDirectory: boolean
+    isSymlink: boolean
+  }
+
+  interface FileInfo {
+    isFile: boolean
+    isDirectory: boolean
+    isSymlink: boolean
+    size: number
+    mtime: Date | null
+  }
+
+  function readDir(path: string): AsyncIterable<DirEntry>
+  function readTextFile(path: string): Promise<string>
+  function stat(path: string): Promise<FileInfo>
+
+  function serve(
+    options: { port: number; hostname?: string; onListen?: (params: { hostname: string; port: number }) => void },
+    handler: (req: Request) => Response | Promise<Response>,
+  ): void
+}
+`
+}
+
+/** `functions/tsconfig.json` — owns function files so the app config can exclude them. */
+export function functionsTsConfigSource(): string {
+  return `{
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": ["ES2022", "DOM", "DOM.Iterable"],
+    "strict": true,
+    "noEmit": true,
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "isolatedModules": true,
+    "skipLibCheck": true,
+    "allowImportingTsExtensions": true,
+    "types": []
+  },
+  "include": ["./**/*.ts", "./deno.d.ts"]
+}
+`
+}
+
+export type FunctionsDenoTypesResult = {
+  wroteDenoDts: boolean
+  wroteTsconfig: boolean
+  rootExclude: "updated" | "already" | "missing" | "manual"
+  hints: string[]
+}
+
+/**
+ * Ensure `functions/deno.d.ts` + `functions/tsconfig.json` exist, and try to
+ * exclude `functions` from the project-root `tsconfig.json`.
+ */
+export function ensureFunctionsDenoTypes(
+  projectRoot: string,
+  functionsDir: string,
+): FunctionsDenoTypesResult {
+  mkdirSync(functionsDir, { recursive: true })
+
+  const denoDtsPath = join(functionsDir, "deno.d.ts")
+  const tsconfigPath = join(functionsDir, "tsconfig.json")
+
+  let wroteDenoDts = false
+  if (!existsSync(denoDtsPath)) {
+    writeFileSync(denoDtsPath, functionsDenoAmbientSource(), "utf8")
+    wroteDenoDts = true
+  }
+
+  let wroteTsconfig = false
+  if (!existsSync(tsconfigPath)) {
+    writeFileSync(tsconfigPath, functionsTsConfigSource(), "utf8")
+    wroteTsconfig = true
+  }
+
+  const rootExclude = ensureRootTsconfigExcludesFunctions(projectRoot)
+  const hints: string[] = []
+  const fnRel = toPosix(relative(projectRoot, functionsDir)) || "functions"
+
+  if (rootExclude === "manual") {
+    hints.push(
+      `Add "functions" to the root tsconfig.json "exclude" array so the app checker skips ${fnRel}/.`,
+    )
+  } else if (rootExclude === "missing") {
+    hints.push(
+      `If you add a root tsconfig.json, exclude "${fnRel}" (or "functions") so app typecheck stays separate.`,
+    )
+  }
+
+  return { wroteDenoDts, wroteTsconfig, rootExclude, hints }
+}
+
+function ensureRootTsconfigExcludesFunctions(
+  projectRoot: string,
+): FunctionsDenoTypesResult["rootExclude"] {
+  const path = join(projectRoot, "tsconfig.json")
+  if (!existsSync(path)) return "missing"
+
+  const raw = readFileSync(path, "utf8")
+  const parsed = ts.parseConfigFileTextToJson(path, raw)
+  if (parsed.error || parsed.config === undefined || typeof parsed.config !== "object") {
+    return "manual"
+  }
+
+  const cfg = parsed.config as { exclude?: unknown }
+  const exclude = Array.isArray(cfg.exclude) ? cfg.exclude.map(String) : []
+  if (exclude.some(isFunctionsExcludeEntry)) return "already"
+
+  try {
+    const asJson = JSON.parse(raw) as { exclude?: string[] }
+    asJson.exclude = [...(Array.isArray(asJson.exclude) ? asJson.exclude : []), "functions"]
+    writeFileSync(path, `${JSON.stringify(asJson, null, 2)}\n`, "utf8")
+    return "updated"
+  } catch {
+    // JSONC / trailing commas — try a conservative string splice into an existing exclude array.
+    if (/"exclude"\s*:\s*\[/.test(raw)) {
+      const next = raw.replace(/("exclude"\s*:\s*\[)/, `$1\n    "functions",`)
+      if (next !== raw) {
+        writeFileSync(path, next, "utf8")
+        return "updated"
+      }
+    }
+    return "manual"
+  }
+}
+
+function isFunctionsExcludeEntry(entry: string): boolean {
+  const n = entry.replace(/\\/g, "/").replace(/^\.\//, "")
+  return n === "functions" || n === "functions/**" || n.startsWith("functions/")
+}
+
+function toPosix(path: string): string {
+  return path.replace(/\\/g, "/")
+}

package/src/hook-upload.ts

@@ -0,0 +1,107 @@
+/**
+ * Package a project's hooks for a managed stack.
+ *
+ * Self-hosted stacks need none of this: the worker mounts the project directory, so `hooks/` is already
+ * where it looks. A managed project has no directory — its worker reads a ConfigMap, whose keys may only
+ * contain alphanumerics, `-`, `_` and `.`. So the tree is flattened here, where it can be checked and
+ * explained, rather than in the deploy route where a dropped file would be silent.
+ */
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs"
+import { join, relative } from "node:path"
+
+import { declaredHooks, manifestHooks, type ManifestHookEntry } from "./model-hooks.js"
+
+/** The generated adapter, flattened. `_`-prefixed, so the worker never routes to it. */
+export const ADAPTER_KEY = "_supatype-hooks.ts"
+
+/** What the handlers import locally, and what has to be rewritten to reach the flattened name. */
+const ADAPTER_IMPORT = "../_supatype/hooks.ts"
+
+export interface HookUpload {
+  /** Handler name → its source, flattened and import-rewritten. */
+  handlers: Array<{ name: string; source: string }>
+  /** table → event → config, exactly as the manifest would carry it. */
+  map: Record<string, Record<string, ManifestHookEntry>>
+}
+
+/**
+ * Rewrite the one import a hook handler is generated to make.
+ *
+ * `../_supatype/hooks.ts` is a path that cannot survive flattening, and it is the specifier our own
+ * scaffold writes — so it is rewritten rather than refused. Any *other* relative import is refused
+ * below: it would resolve to nothing on the worker, and a hook that fails to import is a hooked table
+ * whose writes all start failing.
+ */
+function rewriteAdapterImport(source: string): string {
+  return source.split(ADAPTER_IMPORT).join(`./${ADAPTER_KEY}`)
+}
+
+/** Relative specifiers a flattened layout cannot honour, so the caller can refuse with a real reason. */
+function unsupportedImports(source: string): string[] {
+  const found = new Set<string>()
+  // Matches `from "…"` and `import("…")`, which is every form that resolves against the file's own path.
+  for (const match of source.matchAll(/(?:from|import)\s*\(?\s*["'](\.[^"']*)["']/g)) {
+    const specifier = match[1]!
+    if (specifier === ADAPTER_IMPORT || specifier === `./${ADAPTER_KEY}`) continue
+    found.add(specifier)
+  }
+  return [...found].sort()
+}
+
+/**
+ * Read the hooks a schema actually names, ready to upload.
+ *
+ * **Named-only**, not every directory under `hooks/`: an unnamed handler would sit on the worker
+ * holding the service-role key with nothing able to call it. Uploading it buys nothing and widens what
+ * runs with that credential.
+ *
+ * Throws with a message meant for a terminal when a handler cannot be flattened faithfully — the
+ * alternative is a deploy that succeeds and a hook that fails to import, which reads to the caller as
+ * the table's writes being broken for no visible reason.
+ */
+export function readHookUpload(cwd: string, hooksDir: string, ast: unknown): HookUpload | null {
+  const declared = declaredHooks(ast)
+  if (declared.length === 0) return null
+
+  const names = [...new Set(declared.map((hook) => hook.function))].sort()
+  const where = relative(cwd, hooksDir) || hooksDir
+  const handlers: Array<{ name: string; source: string }> = []
+
+  for (const name of names) {
+    const dir = join(hooksDir, name)
+    const entry = join(dir, "index.ts")
+    if (!existsSync(entry)) {
+      throw new Error(`Hook "${name}" has no ${where}/${name}/index.ts`)
+    }
+
+    const extra = readdirSync(dir)
+      .filter((file) => file !== "index.ts")
+      .filter((file) => statSync(join(dir, file)).isFile() || !file.startsWith("."))
+    if (extra.length > 0) {
+      throw new Error(
+        `Hook "${name}" has more than one file (${extra.join(", ")}).\n` +
+          `A managed stack serves each hook as a single module today, so the others would not be ` +
+          `uploaded and the hook would fail to import.\nMove what it needs into index.ts, or run this ` +
+          `hook on a self-hosted stack, which mounts the directory as it is.`,
+      )
+    }
+
+    const source = readFileSync(entry, "utf8")
+    const unsupported = unsupportedImports(source)
+    if (unsupported.length > 0) {
+      throw new Error(
+        `Hook "${name}" imports ${unsupported.join(", ")}, which a managed stack cannot resolve.\n` +
+          `Only the generated ${ADAPTER_IMPORT} survives upload; bare specifiers and URLs are fine.`,
+      )
+    }
+
+    handlers.push({ name, source: rewriteAdapterImport(source) })
+  }
+
+  return { handlers, map: manifestHooks(ast) }
+}
+
+/** The generated adapter as a handler-shaped entry, so it travels with them. */
+export function adapterEntry(module: string): { name: string; source: string } {
+  return { name: ADAPTER_KEY.replace(/\.ts$/, ""), source: module }
+}